nesdev.com

What's a long time Pasofami?

I'd guess Engrish for "For a long time, CaH4e3 used Pasofami."

Bisqwit, maybe the easiest thing to do is to mail it to someone who has a dumper. Or drive it somewhere if you live near another forum member. I would think less than $10 US would get it shipped both ways safely.

I don't think that "cheap one-time cartridge dumping" exists... It's not like you can quickly build a device to do it using common household items. If you're very electronics-savvy you can make an EPROM reader with few parts, but you have to know what you're doing or you'll just get frustrated.

If you're not electronics-savvy, you'll have to shell out a decent amount of money on equipment (be it a console-specific dumper, an EPROM programmer, or a PowerPak), or find someone who owns such equipment.

Allright. Thanks for the suggestions.

Right now I've got two venues I might try. Either I'll build that LPT thing -- I think I sort of understand how it works now, or somewhat later, I'll see if I can make something useful with an Arduino board, which I plan to buy some day.

If you have an LTP port, couldnt you buy a cheap eprom programmer and wire jumpers to the pins on the chips without removing them them from the board, if your lucky the pins maybe long enough to be pinched by the slot on the programmer.

Yes, it is. My fault.

Just get a willem off ebay, they're like 10 or 15$. Or check Farrid's post, he posted about an easy to build USB programmer not long ago.

I can't think of something simpler or cheaper than mailing it so somebody who is already set up to dump carts.

Wow, I found my stash.
I knew I should have more than that which I showed previously, but it was packed away from my last move in a location I had not bothered to unpack.
(Back as a teenager, I used to salvage components from trashed electronics in hopes I could use them later in something. I also got some parts from friends as explained earlier.)



In the passing week or so, I ordered an Arduino Mega2560 board (or a clone thereof; it costs under 20 €, plus some extra for a breadboard). I have successfully used it to dump a 64 kilobyte 386sx PC ROM BIOS, as a proof of concept that it can be used as a makeshift EPROM reader. (I'll post a YouTube video about the process eventually.)
I have not yet figured out how to safely desolder the ROM chips from my cartridge (and initial attempts with an ISA bus proved that my attempts can damage the goods rather much; granted I don't have any particular desoldering equipment), so that project does not have an immediate solution in sight yet.
But now it turns out that I have many other EPROMs to dump, as well... Heh.

I also purchased a desoldering pump. Figured it's something I would eventually need anyway.
As a consequence, I was now able to successfully desolder both ROM chips from the cartridge.

I was also able to dump them using my Arduino program. There was a slight problem in doing so: The legs of the ROM chips are short, and if the ROM chip is inserted into a standard issue breadboard, the chip just does not make proper contact with the springs and it just pops out. So during the dumping I had to press hard on the chip with both thumbs to ensure it reads all bits properly. Even then, I had to dump it several times, because I saw missing bits / discrepancies between successive dumps. Finally, I added in the ROM dumper some code that reads the ROM several times and chooses the result that has most bits on (and indicates if there were discrepancies). Coincidentally, I finally got them both without discrepancies.


So now I have two 65536 byte files containing the respective ROM data from both chips.
([EDIT: The PRG ROM is actually 128 kilobytes, so 128+64 it should be. I underdumped. I figured this out and perfectly fixed it later. This is an older post.])


Now, I need to figure out what kind of mapper this board has. I mean, I can see it has two 74LS161As (4-bit binary counter) and one 74LS153 (dual 4-input multiplexer) (see photos in the first post), but that does not tell me much. I created a dummy test ROM by just putting a 16-byte header, the 65536-byte PRG ROM and the 65536-byte CHR ROM in a sequence and running through 256 iNES mapper numbers and seeing how they work in FCEU. From those tests (collectively), I was able to get a properly functioning main menu (with links leading nowhere), a properly working Urban Champion game, a properly working Legend of Kage with broken graphics, and a semi-properly working Galaxian with utterly broken graphics. Work in progress...



Taking the ROM page that has the main menu program only, and tracing it using my own emulator, I found out which memory writes it does when a game is chosen.

At reset: Byte $00 is written to $FF00, and $00 is written to $FF00 (again).
Choose game 0: Byte $00 is written to $FFA5, $00 to $FF00 and $E2 to $FF03.
Choose game 1: Byte $00 is written to $FFC8, $00 to $FF00 and $E2 to $FF03.
Choose game 2: Byte $00 is written to $FF10, $00 to $FF00 and $E2 to $FF03.
Choose game 3: Byte $00 is written to $FFED, $00 to $FF00 and $E2 to $FF03.
Choose game 4: Byte $00 is written to $FF03, $00 to $FF00 and $E2 to $FF03.
From this, it looks like it uses the address, rather than the data, to choose a function. (And indeed, the data lines from the ROM chips are directly wired into the cartridge's data lines without intervention if I read right.) However, what those functions are is so far a bit unclear. It looks like the low 4 bits choose VROM page and the next 4 might bits choose a ROM page, or vice versa, but this is mere guessing.
Also, what kind of mapping functions does it provide for the games themselves? I think at least Goonies ought to use more than one VROM page.

EDIT: I traced (some of) the pinouts on the cartridge to help figuring out what the mapper does.

You might have underdumped the PRG; the 74'161's outputs only makes sense to be connected to pin 22 of the ROM if it's actually A16.

Independently tracing the PCB pictures you took, you've got an 8-bit mapper register, input from the address bus (A7..A0), loaded on writes to PRGROM. The capacitor and diode below IC1 cause both registers to reset to 0 on initial powerup.

The latched values written to:
A7..A5 somehow form the PRG bank select
A4 probably selects 16kB vs 32kB PRG, but I can't quite tell from your connectivity description
A3..A1 select a 8kB slice of CHR.
A0 seems to select Vertical vs Horizontal mirroring

Yes, I also arrived to the same conclusion (from different observations), and in fact have now dumped also the second 64k portion. The second chip does have only 64k.

Incredible analysis that of yours!

Were you counting the pins funny? This makes more sense, and is what I see on your pictures:

I assume CIRAM A10 is connected to IC3.PIN9 (74'153.Zb) and Ground -> IC3.PIN15; can you find out what pins are connected to IC3.PIN2/5/6/7 (S1/I1a/I0a/Za) ?

Yes, you are correct at least for the first line. (That one you can see from the photo.)
The two others are impossible to tell for sure because they go under the ICs in question.

IC3.PIN2 goes somewhere underneath the chip, or nowhere at all.
IC3.PIN5,6 are interconnected. I don't know if they have other connections underneath the chip.
Same for pin 7: underneath the chip. Without desoldering the chip there's no way to see where it goes.